CVE-2026-102805 Details

A vulnerability has been identified in the Nothings STB image writing library, specifically in versions of 'stb_image_write.h' prior to 1.16. The issue arises from the 'stbi_write_png_to_mem', 'stbi_write_jpg_core', and 'stbi_write_tga_core' functions, where size calculations using 'int' arithmetic can overflow when handling large images. This overflow leads to memory corruption by either truncating values or creating negative offsets, which can be exploited remotely. The vulnerability causes a heap buffer overflow during PNG encoding and out-of-bounds reads in JPEG and TGA encoding.